TC-001

Verify that API integration enforces token-based authentication. (User Flow, Authenticated)

1. Generate a valid authentication token via Airflow CLI and the main sign-in page airflow auth login --api-url=https://example-url 

2. Check if the token is placed properly under its directories ~/.airflow/config

3. Execute a CLI command (e.g., airflow dags list).

4. Capture the API request sent by the CLI.

5. Verify response executed the requested command properly (e.g. dags list).

The API processes the request successfully, and the CLI outputs the correct result.

Positive

TC-002

Verify that API integration enforces token-based authentication. (User Flow, Unauthenticated)

1. Ensure there isn't any authentication from CLI ~/.airflow/config

2. Execute the CLI command (e.g., airflow dags list).

3. Capture the API request sent by the CLI.

4. Verify CLI displays an appropriate error message.

The API returns an authentication error, and the CLI displays an appropriate error message.

Negative

TC-003

Verify that API integration enforces token-based authentication. (Automated Flow, Authenticated)

1. Create the user as an automated user
2. Generate tokens for automated users with respective expiration dates.

3. Generate a valid authentication token via Airflow CLI and the main sign-in page airflow auth configure --api-url=https://example-url --token=<valid_token>

4. Check if the token is placed properly under its directories ~/.airflow/config

5. Execute a CLI command (e.g., airflow dags list).

6. Capture the API request sent by the CLI.

7. Verify response executed the requested command properly (e.g. dags list).

The API processes the request successfully, and the CLI outputs the correct result.

Positive

TC-004

1. Ensure there isn't any authentication from CLI ~/.airflow/config

2. Execute the CLI command (e.g., airflow dags list --token=<invalid_token> OR AIRFLOW_CLI_TOKEN=<TOKEN> airflow dags list).

3. Capture the API request sent by the CLI.

4. Verify CLI displays an appropriate error message.

TC-005

Verify that API integration respects RBAC policies.

1. Assign a user to a role with limited permissions (e.g., don't have permission can view DAGs ).

2. Ensure CLI is authenticated.

3. Execute CLI command airflow dags list

4. Verify CLI displays an appropriate error message.

Restricted actions fail with an authorization error.

Negative

TC-006

Verify that API integration respects RBAC policies.

1. Assign a user to a role with limited permissions (e.g., don't have permission can view DAGs ).

2. Ensure CLI is authenticated.

3. Execute CLI command airflow dags list

4. Verify response executed the requested command properly dags list .

Allowed actions succeed and return the correct data.

Positive

TC-007

Ensure that the CLI handles API downtime gracefully.

1. Simulate API downtime (e.g., stop the API service or block network access).

2. Ensure CLI is authenticated.

3. Execute a CLI command (e.g., airflow dags list).

4. Observe the CLI behaviour and error messages.

The CLI displays a clear and user-friendly error message indicating that the API is unavailable.

Edge

TC-008

Ensure that sensitive data is not exposed in CLI outputs or API responses.

1. Ensure CLI is authenticated.

2. Execute a CLI command that interacts with sensitive data (e.g., airflow connections list).

3. Review the CLI output for any sensitive information (e.g., passwords, tokens).

4. Capture the corresponding API response and check for sensitive data exposure.

Neither the CLI output nor the API response exposes sensitive data. Placeholder values (e.g., ***) are used where applicable.

Positive

TC-009

Ensure that CLI commands trigger the correct API calls and logs reflect the endpoint usage.

1. Ensure CLI is authenticated.

2. Execute a CLI command (e.g., airflow dags list).

3. Access the API logs to identify the endpoint called.

4. Verify that the logged API call matches the expected behaviour for the CLI command.

The API logs show the correct endpoint is triggered.

Positive